fix: stale prisma client, admin auth guards, env policy, and repo hygiene CI

[chinoyenmose]

Closes #583
Closes #584
Closes #585
Closes #586

What changed

• Main branch test suite is red: 64 failing tests across 15 suites #583: Add getAdminAuth fail-closed guard to 9 erasure/referral admin handlers that returned 500 instead of 401 without identity; widen logBackgroundJob/recordBackgroundJob status type to accept dry_run (fixes 4 suites that couldn't compile)
• Run prisma generate automatically before tests and build #584: Add pretest script running npx prisma generate automatically before npm test; add prisma generate to prebuild pipeline
• Reconcile .gitignore policy for tracked .env.* files #585: Explicit .gitignore negations for .env.development, .env.production, .env.test; add env-secret-scan.yml CI workflow scanning tracked .env* files for high-entropy secret patterns
• Add repo-hygiene CI check to reject PR clutter files at repo root #586: Add repo-hygiene.yml CI workflow rejecting PR clutter files at repo root (PR_*SUMMARY*.md, IMPLEMENTATION_SUMMARY.md, *FIX*.md, *GUIDE*.md, verify_*.sh, fix-*.sh, docs/superpowers/plans/); document policy in CONTRIBUTING.md

Why

• Admin handlers could be called without identity and returned 500 (leaking stack traces) instead of 401
• Stale Prisma client caused TS2339/TS2353 compile failures on clean checkouts
• Tracked .env.* files had no self-documenting gitignore policy or secret scanning
• One-off contributor artifacts kept landing at repo root

How to test

• npx jest tests/unit/admin-route-boundaries.test.ts — 67 passed (was 58/67)
• npx jest tests/integration/analytics/csvExport.integration.test.ts — 6 passed
• npm test now runs prisma generate first via pretest
• CI workflows validate env secrets and repo hygiene on PRs
• Pre-existing test failures (47, down from 56) remain and are tracked separately

Note: Pre-push hook still fails on pre-existing test failures documented in #583. This PR reduces failures from 56 to 47. Remaining failures (migrationProcess rollback.sql gaps, secrets config tests, referral mocks, etc.) need separate fixes.

[drips-wave]

@chinoyenmose Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits